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DETAILED ACTION 

1. Claims 1-22 have been examined. 

Claim Rejections - 35 USC § 101 

2. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

3. Claims 18-22 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. Claim 18 is directed to an access control generation 
program. The examiner respectfully asserts that the claimed subject matter does not fall within 
the statutory class listed under 35 U.S.C 101. Claim 18 is directed to a functional descriptive 
material that is embodied in a signal/carrier wave. A data signal does not fall within one of the 
four statutory classes of 35 USC 101. Claim 18 is rejected as being directed to a data signal. 
Claims 19-22 depend from claim 18 and are rejected under the same rationale. 

Claim Rejections - 35 USC § 102 

4. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

5. Claims 1-22 are rejected under 35 U.S.C. 102(b) as being anticipated by EP 0 992.873 
A2 Hashimoto et al. (hereinafter Hashimoto). 
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6. As per claims 1 and 18, Hashimoto teaches a computer-implemented method for 
generating access control information, the method comprising: 

receiving an access control rule that identifies a characteristic (i.e., access-right setting 
pattern list) [column 7, lines 48-56 and figure 3]; 

identifying at least one entry in user information that is associated with the identified 
characteristic [column 8, lines 10-19]; 

identifying at least one entry in data object (i.e., content) information that is associated 
with the identified characteristic [column 7, lines 56-column 8, lines 10]; and 

generating access control information that permits at least one user associated with the 
at least one entry in the user information to access the at least one entry in the data object 
information [column 8, lines 20-49]. 

7. As per claim 10, Hashimoto teaches a computer system for managing access control 
information for software operating on the computer system, the system comprising: 

a data repository for access control information for software, the data repository 
including user information identifying a user characteristic for at least one entry in the user 
information [column 8, lines 10-19], data object information identifying a data object 
characteristic for at least one entry in the data object information [column 7, lines 56-column 8, 
lines 10], and access control rule information identifying a shared characteristic for at least one 
entry in the access control rule information [column 8, lines 20-49]; and 

an executable software module that causes (1) a comparison of the user characteristic, 
the business object characteristic, and the shared characteristic and (2) generation of access 
control information for use in determining whether a user that is associated with an entry in the 
user information is permitted to access a data object that is associated with an entry in the data 
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object information such that when the user characteristic, the data object characteristic and the 
shared characteristic each correspond to one another, the user is permitted to access the data 
object [column 8, lines 43-column 9, lines 7]. 

8. As per claims 2 and 11-12, Hashimoto further teaches the method wherein, the identified 
characteristic is indirectly associated with the at least one entry in the user information, and 
identifying at least one entry in user information that is associated with the identified 
characteristic comprises identifying at least one entry in user information that is indirectly 
associated with the identified characteristic [column 8, lines 10-19 and figure 3-5]. 

9. As per claim 3, Hashimoto further teaches the method wherein, the identified 
characteristic is directly associated with the at least one entry in the user information, and 
identifying at least one entry in user information that is associated with the identified 
characteristic comprises identifying at least one entry in user information that is directly 
associated with the identified characteristic [column 8, lines 10-19 and figure 3-5]. 

10. As per claims 4-7 and 13-17, Hashimoto further teaches the method wherein, generating 
access control information comprises: generating user access control information that identifies 
the at least one entry in the user information that is associated with the identified characteristic, 
generating object access control information that identifies the at least one entry in the data 
object information that is associated with the identified characteristic, and associating at least 
one entry in the user access control information with at least one entry in the data object access 
control information [column 8, lines 20-49]. 
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11. As per claims 8, 9, 21 and 22, Hashimoto further teaches the method further comprising 
receiving a filter condition, wherein generating access control information further comprises 
generating access control information by eliminating at least one entry in the user 
information/data object information that corresponds to the received filter condition such that 
access control information does not include the eliminated at least one entry in the user data 
object information [column 8, lines 5-39]. 

12. As per claims 19 and 20, Hashimoto further teaches the method wherein the one or 
more code segments configured to generate access control information comprise one or more 
code segments configured to: generate user access control information that identifies the at 
least one entry in the user information that is associated with the identified characteristic, 
generate object access control information that identifies the at least one entry in the data object 
information that is associated with the identified characteristic, and associate at least one entry 
in the user access control information with at least one entry in the data object access control 
information [column 8, lines 5-36]. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. See PTO Form 892. 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Beemnet W. Dada whose telephone number is (571) 272-3847. The 
examiner can normally be reached on Monday - Friday (9:00 am - 5:30 pm). 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions oh access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Beemnet W Dada 
January 5, 2007 
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